You need to provide connectivity to storage1. The solution must meet the PaaS networking requirements and the business requirements.

What should you include in the solution?

Reveal Solution Hide Solution

You have an Azure virtual network that contains a subnet named Subnet1. Subnet1 is associated to a network security group (NSG) named NSG1. NSG1 blocks all outbound traffic that is not allowed explicitly.

Subnet1 contains virtual machines that must communicate with the Azure Cosmos DB service.

You need to create an outbound security rule in NSG1 to enable the virtual machines to connect to Azure Cosmos DB.

What should you include in the solution?

Reveal Solution Hide Solution

DRAG DROP

You have three on-premises sites. Each site has a third-party VPN device.

You have an Azure virtual WAN named VWAN1 that has a hub named Hub1. Hub1 connects two of the three on-premises sites by using a Site-to-Site VPN connection.

You need to connect the third site to the other two sites by using Hub1.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

Reference: https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-site-to-site-portal

You have an Azure Front Door instance named FD1 that is protected by using Azure Web Application Firewall (WAF).

FD1 uses a frontend host named app1.contoso.com to provide access to Azure web apps hosted in the East US Azure region and the West US Azure region.

You need to configure FD1 to block requests to app1.contoso.com from all countries other than the United States.

What should you include in the WAF policy?

Reveal Solution Hide Solution

HOTSPOT

You need to connect an on-premises network and an Azure environment. The solution must use ExpressRoute and support failing over to a Site-to-Site VPN connection if there is an ExpressRoute failure.

What should you configure? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

To connect an on-premises network to an Azure environment with a solution that uses ExpressRoute and supports failover to a Site-to-Site VPN connection in case of an ExpressRoute failure, you should use the following configurations:

Routing type:

For supporting both ExpressRoute and Site-to-Site VPN, you would use a Route-based VPN type. Policy-based VPNs do not support the dynamic routing that is necessary for ExpressRoute and VPN failover scenarios.

Number of virtual network gateways:

You would typically need 2 virtual network gateways for this scenario: one for the ExpressRoute connection and another for the Site-to-Site VPN connection. Azure supports the coexistence of ExpressRoute and Site-to-Site VPN connections, allowing you to configure them for high-availability scenarios. Each type of connection requires a separate gateway.

Therefore, the appropriate options are "Route-based" for the routing type and "2" for the number of virtual network gateways.

HOTSPOT

You have an Azure subscription that contains a single virtual network and a virtual network gateway. You need to ensure that administrators can use Point-to-Site (P2S) VPN connections to access resources in the virtual network. The connections must be authenticated by Azure Active Directory (Azure AD).

What should you configure? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

You have the Azure environment shown in the exhibit.

VM1 is a virtual machine that has an instance-level public IP address (ILPIP).

Basic Load Balancer uses a public IP address. VM1 and VM2 are in the backend pool.

NAT Gateway uses a public IP address named IP3 that is associated to Subnet A.

VNet1 has a virtual network gateway that has a public IP address named IP4.

When initiating outbound traffic to the internet from VM1, which public address is used?

Reveal Solution Hide Solution

HOTSPOT

You have the Azure App Service app shown in the App Service exhibit.

The VNet Integration settings for as12 are configured as shown in the Vnet Integration exhibit.

The Private Endpoint connections settings for as12 are configured as shown in the Private Endpoint connections exhibit.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

Based on the information provided in the screenshots regarding Azure App Service and its VNet Integration and Private Endpoint connections, let’s address the statements provided:

Subnet2 can contain only App Service apps in the ASP1 App Service plan.

No, this statement is not necessarily true. A subnet can contain multiple app services from different App Service plans, not just a single one like ASP1. The App Service plan determines the location, features, cost, and compute resources associated with an app, but multiple plans can use the same subnet for integration.

As12 will use an IP address from Subnet2 for network communications.

Yes, if the Azure App Service ‘as12’ is integrated with a VNet that includes Subnet2, it will use an IP address from Subnet2’s range for network communications within that VNet.

Computers in Vnet1 will connect to a private IP address when they connect to as12.

No, the screenshots do not show any configured private endpoint connections for the ‘as12’ app service, which would be required for ‘as12’ to have a private IP address within the VNet. Without a private endpoint, computers in Vnet1 would connect to the public IP address of ‘as12’, unless further configuration is done outside of what is shown in the screenshots.

DRAG DROP

You have an Azure Front Door instance named FrontDoor1.

You deploy two instances of an Azure web app to different Azure regions.

You plan to provide access to the web app through FrontDoor1 by using the name app1.contoso.com. You need to ensure that FrontDoor1 is the entry point for requests that use app1.contoso.com.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Reveal Solution Hide Solution

Correct Answer:

You need to configure GW1 to meet the network security requirements for the P2S VPN users.

Which Tunnel type should you select in the Point-to-site configuration settings of GW1?

Reveal Solution Hide Solution